UBUNTU-CVE-2026-64259

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: make a fusereq on SQE commit only findable after memcpy Bad userspace might try to trick us and send commit SQEs request unique / commit-id of requests that are not even send to fuse-server iouringcmddone not called...

CVE-2026-64426

In the Linux kernel, the following vulnerability has been resolved: iouring/nop: fix file reference leak with IOSQEFIXEDFILE NOP file-acquisition support choses between a fixed registered file and a normal fget'd file based on its own IORINGNOPFIXEDFILE flag in sqe-nopflags. However, a request's...

CVE-2026-64425 io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item

In the Linux kernel, the following vulnerability has been resolved: iouring/io-wq: re-check IOWQBITEXIT for each linked work item commit 10dc95939817 "iouring/io-wq: check IOWQBITEXIT inside work run loop" fixed the obvious case where ioworkerhandlework took one exit-bit snapshot before draining...

CVE-2026-64426 io_uring/nop: fix file reference leak with IOSQE_FIXED_FILE

In the Linux kernel, the following vulnerability has been resolved: iouring/nop: fix file reference leak with IOSQEFIXEDFILE NOP file-acquisition support choses between a fixed registered file and a normal fget'd file based on its own IORINGNOPFIXEDFILE flag in sqe-nopflags. However, a request's...

CVE-2026-64425 io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item

In the Linux kernel, the following vulnerability has been resolved: iouring/io-wq: re-check IOWQBITEXIT for each linked work item commit 10dc95939817 "iouring/io-wq: check IOWQBITEXIT inside work run loop" fixed the obvious case where ioworkerhandlework took one exit-bit snapshot before draining...

CVE-2026-64426

In the Linux kernel, the following vulnerability has been resolved: iouring/nop: fix file reference leak with IOSQEFIXEDFILE NOP file-acquisition support choses between a fixed registered file and a normal fget'd file based on its own IORINGNOPFIXEDFILE flag in sqe-nopflags. However, a request's...

EUVD-2026-48769

In the Linux kernel, the following vulnerability has been resolved: iouring/io-wq: re-check IOWQBITEXIT for each linked work item commit 10dc95939817 "iouring/io-wq: check IOWQBITEXIT inside work run loop" fixed the obvious case where ioworkerhandlework took one exit-bit snapshot before draining...

EUVD-2026-48770

In the Linux kernel, the following vulnerability has been resolved: iouring/nop: fix file reference leak with IOSQEFIXEDFILE NOP file-acquisition support choses between a fixed registered file and a normal fget'd file based on its own IORINGNOPFIXEDFILE flag in sqe-nopflags. However, a request's...

CVE-2026-64426 io_uring/nop: fix file reference leak with IOSQE_FIXED_FILE

In the Linux kernel, the following vulnerability has been resolved: iouring/nop: fix file reference leak with IOSQEFIXEDFILE NOP file-acquisition support choses between a fixed registered file and a normal fget'd file based on its own IORINGNOPFIXEDFILE flag in sqe-nopflags. However, a request's...

CVE-2026-64426

A file reference leak in the Linux kernel's io_uring/nop component occurs when a NOP request is submitted with IOSQE_FIXED_FILE set but without IORING_NOP_FIXED_FILE . The io_nop() handler takes the normal file-acquisition path and grabs a real file reference via io_file_get_normal() , but on com...

CVE-2026-64425

In the Linux kernel, the following vulnerability has been resolved: iouring/io-wq: re-check IOWQBITEXIT for each linked work item commit 10dc95939817 "iouring/io-wq: check IOWQBITEXIT inside work run loop" fixed the obvious case where ioworkerhandlework took one exit-bit snapshot before draining...

CVE-2026-64425

CVE-2026-64425 affects the Linux kernel's io_uring/io-wq subsystem. A prior fix introduced a check for IO_WQ_BIT_EXIT in the outer work run loop, but it still snapshots the exit bit once before processing an entire dependent linked-work chain. If io_wq_exit_start() sets the bit after the first li...

CVE-2026-64263 fuse-uring: fix moving cancelled entry to ent_in_userspace list

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix moving cancelled entry to entinuserspace list fuseuringcancel moves entries that are available these have no reqs attached to the entinuserspace list. entlistrequestexpired checks the first entry on entinuserspace...

PT-2026-64647

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the io uring/nop component when handling file references. The issue arises when a NOP request is submitted with the IOSQE FIXED FILE flag set but without the IORI...

Linux Distros Unpatched Vulnerability : CVE-2026-64262

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: fuse-uring: end fusereq on io-uring cancel task work When iouring delivers task work with...

Linux Distros Unpatched Vulnerability : CVE-2026-64426

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: iouring/nop: fix file reference leak with IOSQEFIXEDFILE NOP file-acquisition support choses...

CVE-2026-64426: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iouring/nop: fix file reference leak with IOSQEFIXEDFILE NOP file-acquisition support choses between a fixed registered file and a normal fget'd file based on its own IORINGNOPFIXEDFILE flag in sqe-nopflags. However, a request's...

Linux Distros Unpatched Vulnerability : CVE-2026-64425

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iouring/io-wq: re-check IOWQBITEXIT for each linked work item commit 10dc95939817 iouring/io-wq: check IOWQBITEXIT inside work run loop fixed the obvious case...

CVE-2026-64262: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: end fusereq on io-uring cancel task work When iouring delivers task work with tw.cancel set PFEXITING, PFKTHREAD fallback, or percpurefisdying on the ring context, fuseuringsendintask takes the cancel branch, assigns...

CVE-2026-64425: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iouring/io-wq: re-check IOWQBITEXIT for each linked work item commit 10dc95939817 "iouring/io-wq: check IOWQBITEXIT inside work run loop" fixed the obvious case where ioworkerhandlework took one exit-bit snapshot before draining...